1. Malta
2. Privacy policy

Privacy policy

This policy explains which personal data we process, why, and what rights you have, under the General Data Protection Regulation (GDPR) and the Data Protection Act (Cap. 586).

Controller

What data we process

• Customers: name, email, password (encrypted), pickup and destination addresses, location during a request or journey, journey preferences (music, conversation, temperature, notes), favourite drivers, scheduled journeys and ratings.
• Drivers: name, phone, email, licence number and area, registration and vehicle details, photos of the driver and vehicle, licence documents, location while working, journeys completed, distance, meter amounts entered voluntarily and ratings.
• Everyone: technical data needed to run the service (device, date and time of access) and messages you send us.

Purposes and legal bases

• Matching (account, assigning the taxi, arrival, ratings): performance of a contract (Art. 6(1)(b) GDPR).
• Safety and fraud prevention (checks on sign-ups, repeated cancellations, suspensions): legitimate interest (Art. 6(1)(f)).
• Legal obligations (tax, requests from authorities): legal obligation (Art. 6(1)(c)).
• Driver subscription (payments and invoices): performance of a contract and legal obligation.

We do not use your data for third-party advertising and we take no automated decisions with legal effects, apart from the automatic assignment of the nearest taxi and the automatic suspensions described in the terms of use, which you can challenge through the contact page.

Location data

Location is essential to the service. The customer's location is used during the request and the journey; the driver's only while they are online and free or busy, and the last position is deleted when they log off. The route of each journey is kept for 30 days in case of complaints and then deleted.

Who sees your data

• The assigned driver sees the customer's first name, pickup point, destination, number of passengers, options and preferences, and the customer's location while waiting.
• If you share your journey, anyone with the link sees your first name, pickup point, destination, the taxi and its position during the journey. The link stops working 30 minutes after the journey ends.
• The customer sees the assigned driver's first name, photo, vehicle, registration, average rating and position.
• Processors: database hosting (Supabase, servers in the European Union), website hosting, maps and routes (OpenFreeMap, OSRM, TomTom if enabled), address search (Photon) and taxi ranks (OpenStreetMap). Map services receive coordinates or the search text, but not your name or email.

How long we keep data

While your account exists. After it is deleted we keep only what legal retention periods (for example invoices) or the handling of complaints require, and then delete it.

So that the free period for drivers is only given once, we keep an encrypted, irreversible code (fingerprint) of the licence, registration, phone and email together with the end date of that period, also after the account is deleted. It does not reveal that data and is only used to prevent repeated sign-ups.

Your rights

You can ask for access, rectification, erasure, objection, restriction of processing and data portability by email to info@taxiahora.com or through the contact page. You also have the right to lodge a complaint with the Information and Data Protection Commissioner (idpc.org.mt).

Security

We use appropriate technical and organisational measures: encrypted connections, encrypted passwords, per-user access rules in the database and regular deletion of location data.

Last updated: 19/10/2026